rsms/scrup — pull request #29 by v4lli (2012-04-10 16:41:39+00:00)
Title: Different approach to authentication

Hi there,
I've been using Scrup for a few weeks now and have fallen in love with it, but the authentication-thing has also been bugging me.

I understand that transmitting a secret key together with an upload request over an insecure connection is not "secure" either (as you mentioned in the PR of 16a2da6), but there are a few points to this change:

+ Any authentication is better than none at all
+ SSL solves this problem
+ Although possibly insecure _over-the-cable_, it prevents malicious users from uploading anything to your server
+ The "default" can still be the simple method that does not require a key

So, I took the freedom of forking your code and came up with this:
![New 'Secret' Input Field](http://unimplemented.org/~valli/pics/scrup.png)

I've also thought about enforcing the use of HTTPS if the secret is set (as you suggested), but I came to the conclusion that this may be limiting _pro_-users.

I tried to keep it simple, please let me know what you think! I'd really like to see such a feature in Scrup, but probably don't have the experience to properly maintain a fork for long. :o

Also, please be gentle with my Objective-C, it's not exactly my every-other-day language. :-)